@intentius/chant-lexicon-terraform 0.57.0 → 0.58.0

package/src/composites/terraform-apply-op.acceptance.test.ts

@@ -3,7 +3,8 @@
  *
  * Everything else in this lexicon's Op suite proves the shape of what chant
  * emits. This proves the shape runs: build a `TerraformApplyOp` with
- * `gate: "never"` (the local executor refuses any Op containing a gate), hand
+ * `gate: "never"` (a gate ends a local run as `gated` since #2119, so an
+ * acceptance run that must reach Apply declares none), hand
  * it to `runOpLocally` with the activities the registry resolves by
  * convention, and let a real `terraform` — or `tofu` — init, plan and apply
  * the #2083 `with-backend` fixture root into a temp directory. Two
@@ -23,13 +24,21 @@
 
 import { execSync } from "node:child_process";
 import { lookup } from "node:dns/promises";
-import { cpSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { cpSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterAll, describe, expect, it } from "vitest";
 import { loadActivities, loadProfiles, runOpLocally, type OpConfig } from "@intentius/chant/op";
 import { TerraformApplyOp } from "./terraform-apply-op";
-import { terraformShow } from "../op/activities/terraform";
+import {
+  MIN_CHOUDOUFU_VERSION,
+  isOlderVersion,
+  parseChoudoufuVersion,
+  terraformApply,
+  terraformInit,
+  terraformPlan,
+  terraformShow,
+} from "../op/activities/terraform";
 
 function onPath(cmd: string): boolean {
   try {
@@ -113,7 +122,7 @@ describe.skipIf(skipReason !== "")(
           await loadProfiles(),
         );
 
-        expect(result.ok).toBe(true);
+        expect(result.status).toBe("ok");
         expect(result.records.map((r) => `${r.phase}:${r.status}`)).toEqual([
           "Init:ok",
           "Plan:ok",
@@ -121,7 +130,7 @@ describe.skipIf(skipReason !== "")(
         ]);
 
         // The plan proposed two creates, and said so through the outcome the
-        // Plan step surfaces as the `Changed` search attribute.
+        // Plan step surfaces as the `Changed` run outcome.
         const plan = result.records.find((r) => r.phase === "Plan")!;
         expect(plan.outcome).toEqual({ name: "Changed", value: true });
 
@@ -136,3 +145,172 @@ describe.skipIf(skipReason !== "")(
     );
   },
 );
+
+/**
+ * `TerraformApplyOp` on a live root, against choudoufu's own pinned emulator
+ * (#2106 follow-up). Two suites, gated the same way
+ * `../op/activities/choudoufu.acceptance.test.ts` is, plus a version floor:
+ *
+ *   - no `choudoufu` on PATH,
+ *   - a `choudoufu` older than {@link MIN_CHOUDOUFU_VERSION}, which is the
+ *     release that shipped the approval artifact
+ *     ([choudoufu #878](https://github.com/INTENTIUS/choudoufu/issues/878),
+ *     PR 889): before it, `plan -out` was refused under a live block and this
+ *     Op could not be built the way it is built now,
+ *   - `CHOUDOUFU_EMULATOR_ENDPOINT` unset (bring up choudoufu's `just smoke`
+ *     docker compose stack and export `http://localhost:<mapped port>`).
+ *
+ * The #894 clause the first version of this suite carried is gone. That issue
+ * is still open, but it is about `live-plan -json`, which the apply Op no
+ * longer runs: the plan half is the stock `plan -out` path. `TerraformWatchOp`
+ * and `TerraformAdoptOp` still need the document and still wait on it.
+ *
+ * The first test is the happy path end to end through `runOpLocally`. The
+ * second is the refusal, and it runs the activities directly rather than
+ * through the Op, because the world has to move between the Plan step and the
+ * Apply step and there is no seam inside a running Op to do that from.
+ */
+
+function versionOf(binary: string): string | undefined {
+  try {
+    return parseChoudoufuVersion(execSync(`${binary} version`, { encoding: "utf8" }));
+  } catch {
+    return undefined;
+  }
+}
+
+const LIVE_FIXTURE = join(import.meta.dirname, "..", "__fixtures__", "live");
+
+/** A throwaway project holding a copy of the live fixture as its one root. */
+function liveProject(): string {
+  const dir = mkdtempSync(join(tmpdir(), "chant-choudoufu-apply-accept-"));
+  workspaces.push(dir);
+  cpSync(LIVE_FIXTURE, join(dir, "root"), { recursive: true });
+  writeFileSync(
+    join(dir, "chant.config.json"),
+    JSON.stringify(
+      { lexicons: ["terraform"], terraform: { binary: "choudoufu", roots: { estate: { dir: "./root" } } } },
+      null,
+      2,
+    ),
+  );
+  return dir;
+}
+
+/** The estate-wide marker sweep configures the AWS provider whatever the root declares. */
+function pointAtTheEmulator(endpoint: string): void {
+  process.env.AWS_ENDPOINT_URL ??= endpoint;
+  process.env.AWS_ACCESS_KEY_ID ??= "choudoufu-emulator";
+  process.env.AWS_SECRET_ACCESS_KEY ??= "choudoufu-emulator";
+  process.env.AWS_DEFAULT_REGION ??= "us-east-1";
+}
+
+const choudoufuVersion = onPath("choudoufu") ? versionOf("choudoufu") : undefined;
+const emulatorEndpoint = process.env.CHOUDOUFU_EMULATOR_ENDPOINT;
+
+const liveSkipReason: string = !onPath("choudoufu")
+  ? "no choudoufu binary on PATH"
+  : choudoufuVersion === undefined
+    ? "the choudoufu on PATH reports no release version (a dev build), so the approval artifact cannot be assumed"
+    : isOlderVersion(choudoufuVersion, MIN_CHOUDOUFU_VERSION)
+      ? `choudoufu ${choudoufuVersion} is older than v${MIN_CHOUDOUFU_VERSION}, which shipped the approval artifact (choudoufu #878)`
+      : !emulatorEndpoint
+        ? "CHOUDOUFU_EMULATOR_ENDPOINT is not set (bring up choudoufu's `just smoke` emulator stack and export it)"
+        : "";
+
+describe.skipIf(liveSkipReason !== "")(
+  `TerraformApplyOp applies a live root against choudoufu's emulator${liveSkipReason ? ` (skipped: ${liveSkipReason})` : ""}`,
+  () => {
+    it(
+      'inits, plans to a file, applies that file, gate: "never" — two null_resources applied',
+      { timeout: 600_000 },
+      async () => {
+        pointAtTheEmulator(emulatorEndpoint!);
+        const project = liveProject();
+
+        const { op } = TerraformApplyOp({
+          name: "choudoufu-acceptance",
+          root: "estate",
+          gate: "never",
+          cwd: project,
+        });
+
+        // The plan file is what crosses the (skipped) gate, so the built Op
+        // has to name one even here, where nothing waits on it.
+        const applyStep = (op as unknown as { props: OpConfig }).props.phases
+          .find((p) => p.name === "Apply")!
+          .steps[0] as { args?: Record<string, unknown> };
+        expect(applyStep.args?.planFile).toBeDefined();
+
+        const activities = await loadActivities(["terraform"]);
+        const result = await runOpLocally(
+          (op as unknown as { props: OpConfig }).props,
+          activities,
+          await loadProfiles(),
+        );
+
+        expect(result.status).toBe("ok");
+        expect(result.records.map((r) => `${r.phase}:${r.status}`)).toEqual(["Init:ok", "Plan:ok", "Apply:ok"]);
+
+        // A live root has no state file to read back: the state cache is not
+        // stock's `terraform.tfstate` and `show` over it renders nothing. The
+        // estate's own answer is the next plan, which is built from the live
+        // system, so what was applied is read back the way choudoufu means it
+        // to be. Empty, and its prior state holds exactly the two resources.
+        const after = await terraformPlan({ root: "estate", cwd: project });
+        expect(after.changed).toBe(false);
+        expect({ adds: after.adds, changes: after.changes, destroys: after.destroys }).toEqual({
+          adds: 0,
+          changes: 0,
+          destroys: 0,
+        });
+        const applied = (
+          (after.json as { prior_state?: { values?: { root_module?: { resources?: Array<{ address?: string }> } } } })
+            .prior_state?.values?.root_module?.resources ?? []
+        ).map((r) => r.address);
+        expect(applied.sort()).toEqual(["null_resource.first", "null_resource.second"]);
+      },
+    );
+
+    it(
+      "a plan file the live system has moved past comes back as a named refusal, not a throw",
+      { timeout: 600_000 },
+      async () => {
+        pointAtTheEmulator(emulatorEndpoint!);
+        const project = liveProject();
+        const mainTf = join(project, "root", "main.tf");
+        const original = readFileSync(mainTf, "utf8");
+
+        await terraformInit({ root: "estate", cwd: project });
+        const plan = await terraformPlan({ root: "estate", cwd: project });
+        expect(plan.changed).toBe(true);
+        expect(plan.adds).toBe(2);
+
+        // The configuration moves after the approval: one of the two resources
+        // the approver read is gone, so the fresh plan the apply builds has a
+        // change the file does not, and the file has one the fresh plan does not.
+        writeFileSync(mainTf, original.replace(/resource "null_resource" "second" \{[\s\S]*?\n\}\n/, ""));
+
+        const refusedRun = await terraformApply({ root: "estate", cwd: project, planFile: plan.planFile });
+        expect(refusedRun.applied).toBe(false);
+        expect(refusedRun.refused).toBe("approval-mismatch");
+        expect(refusedRun.refusal).toContain("The approved plan no longer matches the live system");
+        expect(refusedRun.refusal).toContain("null_resource.second");
+
+        // The sibling refusal, from the same exit status: the file was produced
+        // against another estate than the one this directory now declares.
+        writeFileSync(mainTf, original.replace('estate = "fixture-estate"', 'estate = "renamed-estate"'));
+        const wrongEstate = await terraformApply({ root: "estate", cwd: project, planFile: plan.planFile });
+        expect(wrongEstate.applied).toBe(false);
+        expect(wrongEstate.refused).toBe("wrong-estate");
+        expect(wrongEstate.refusal).toContain("The approved plan belongs to a different estate");
+
+        // And with the world back where the approval found it, the same file applies.
+        writeFileSync(mainTf, original);
+        const applied = await terraformApply({ root: "estate", cwd: project, planFile: plan.planFile });
+        expect(applied.applied).toBe(true);
+        expect(applied.refused).toBeUndefined();
+      },
+    );
+  },
+);

package/src/composites/terraform-apply-op.test.ts

@@ -1,14 +1,19 @@
 /**
  * TerraformApplyOp composite tests (#2086) — the phase names, the gate, the
- * plan-to-apply reference, and the compensation refusal.
+ * plan-to-apply reference, and the compensation refusal. A live root builds
+ * the same four phases (#2106 follow-up), and what is particular to it is
+ * below, in its own describe block.
  */
 
-import { describe, test, expect } from "vitest";
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, describe, test, expect } from "vitest";
 import {
-  findGate,
+  isGated,
   isStepOutputRef,
   runOpLocally,
-  LocalGateUnsupportedError,
+  memoryGateLedgerPort,
   type ActivityStep,
   type GateStep,
   type OpConfig,
@@ -95,7 +100,7 @@ describe("TerraformApplyOp gate (#2086)", () => {
   test("the Gate phase reports the plan's destroy count before it waits", () => {
     // GateStep has no condition field, so "on-destroy" cannot branch at build
     // time. The approver is told instead: a `show` of the saved plan runs
-    // first and surfaces `destroys` as a search attribute.
+    // first and surfaces `destroys` as a run outcome.
     const op = props({ name: "prod-apply", root: "app" });
     const steps = op.phases.find((p) => p.name === "Gate")!.steps;
     const show = steps[0] as ActivityStep;
@@ -168,26 +173,173 @@ describe("TerraformApplyOp compensation — total or refused (#2086)", () => {
   });
 });
 
-describe("TerraformApplyOp on the local executor (#2086)", () => {
-  test("a gated Op is refused up front, naming the signal the local executor cannot wait for", async () => {
+describe("TerraformApplyOp on the local executor (#2086, gate-as-fact #2119)", () => {
+  test("a gated Op stops at the gate and records the pending fact, naming the signal", async () => {
     const op = props({ name: "prod-apply", root: "app" });
-    await expect(runOpLocally(op, new Map(), {})).rejects.toBeInstanceOf(LocalGateUnsupportedError);
+    const ran: string[] = [];
+    const stub = (fn: string) => [fn, async () => { ran.push(fn); return {}; }] as const;
+    const activities = new Map(
+      ["terraformInit", "terraformPlan", "terraformShow", "terraformApply"].map(stub),
+    );
+    const gates = memoryGateLedgerPort();
+    const result = await runOpLocally(op, activities, {}, undefined, { gates, now: "2026-09-05T12:00:00.000Z" });
+
+    expect(result.status).toBe("gated");
+    expect(result.gate?.op).toBe("prod-apply");
+    expect(result.gate?.gate).toBe(op.phases.flatMap((p) => p.steps).find(isGate)?.signalName);
+    expect(gates.appended).toHaveLength(1);
+    // Init, Plan and the pre-gate `show` ran; Apply is behind the gate and did not.
+    expect(ran).toEqual(["terraformInit", "terraformPlan", "terraformShow"]);
   });
 
-  test('gate: "never" clears that refusal, which is what makes `chant run` viable', () => {
-    expect(findGate(props({ name: "prod-apply", root: "app", gate: "never" }))).toBeUndefined();
+  test('gate: "never" means there is no gate to stop at', () => {
+    expect(isGated(props({ name: "prod-apply", root: "app", gate: "never" }))).toBe(false);
+    expect(isGated(props({ name: "prod-apply", root: "app" }))).toBe(true);
   });
 });
 
 describe("TerraformApplyOp Op metadata (#2086)", () => {
-  test("task queue defaults to the name and search attributes name the root", () => {
+  test("labels name the root, and no task queue rides on the Op (#2118)", () => {
     const op = props({ name: "app-apply", root: "app" });
     expect(op.name).toBe("app-apply");
-    expect(op.taskQueue).toBe("app-apply");
-    expect(op.searchAttributes).toEqual({ Apply: "true", TerraformRoot: "app" });
+    expect(op.labels).toEqual({ Apply: "true", TerraformRoot: "app" });
+    expect(op).not.toHaveProperty("taskQueue");
+  });
+});
+
+// ── Live root (#2106) ────────────────────────────────────────────────────────
+
+const dirs: string[] = [];
+
+afterEach(() => {
+  for (const dir of dirs.splice(0)) rmSync(dir, { recursive: true, force: true });
+});
+
+/** A throwaway project whose one root is live, stock, or live with a policy block, per `policy`. */
+function project(policy?: string): string {
+  const dir = mkdtempSync(join(tmpdir(), "chant-tf-apply-op-live-"));
+  dirs.push(dir);
+  mkdirSync(join(dir, "root"), { recursive: true });
+  writeFileSync(
+    join(dir, "root", "main.tf"),
+    [
+      "terraform {",
+      "  live {",
+      '    estate = "fixture-estate"',
+      ...(policy ? ["    policy {", `      ${policy}`, "    }"] : []),
+      "  }",
+      "}",
+      "",
+      'resource "null_resource" "x" {}',
+      "",
+    ].join("\n"),
+  );
+  writeFileSync(
+    join(dir, "chant.config.json"),
+    JSON.stringify({ terraform: { binary: "choudoufu", roots: { estate: { dir: "./root" } } } }),
+  );
+  return dir;
+}
+
+describe("TerraformApplyOp on a live root (#2106 follow-up)", () => {
+  test("the same Init, Plan, Gate, Apply as a stock root, with the plan file paired through", () => {
+    const dir = project();
+    const op = props({ name: "estate-apply", root: "estate", cwd: dir });
+    expect(phaseNames(op)).toEqual(["Init", "Plan", "Gate", "Apply"]);
+
+    const activitySteps = op.phases.flatMap((p) => p.steps.filter(isActivity));
+    expect(activitySteps.map((s) => s.fn)).toEqual([
+      "terraformInit",
+      "terraformPlan",
+      "terraformShow",
+      "terraformApply",
+    ]);
+
+    const plan = op.phases.find((p) => p.name === "Plan")!.steps[0] as ActivityStep;
+    expect(plan.args?.planFile).toBe("chant.tfplan");
+
+    // The Apply step names the Plan step's own output, never a literal path:
+    // on a live root that reference is the approval artifact itself.
+    const apply = op.phases.find((p) => p.name === "Apply")!.steps[0] as ActivityStep;
+    expect(isStepOutputRef(apply.args?.planFile)).toBe(true);
+    expect(apply.args?.planFile).toMatchObject({ step: "plan", path: "planFile" });
+  });
+
+  test("no choudoufuLivePlan step anywhere: the watch and adopt Ops still use it, this one does not", () => {
+    const dir = project();
+    const op = props({ name: "estate-apply", root: "estate", cwd: dir });
+    const fns = op.phases.flatMap((p) => p.steps.filter(isActivity)).map((s) => s.fn);
+    expect(fns).not.toContain("choudoufuLivePlan");
+  });
+
+  test('gate: "never" drops the Gate phase, leaving Init, Plan, Apply', () => {
+    const dir = project();
+    const op = props({ name: "estate-apply", root: "estate", cwd: dir, gate: "never" });
+    expect(phaseNames(op)).toEqual(["Init", "Plan", "Apply"]);
+    expect(op.phases.flatMap((p) => p.steps).some(isGate)).toBe(false);
+  });
+
+  test("Plan reports Changed; the Gate's show step reports Destroys off the saved plan", () => {
+    const dir = project();
+    const op = props({ name: "estate-apply", root: "estate", cwd: dir });
+    const plan = op.phases.find((p) => p.name === "Plan")!.steps[0] as ActivityStep;
+    expect(plan.outcomeAttribute).toEqual({ name: "Changed", from: "changed" });
+
+    const gateSteps = op.phases.find((p) => p.name === "Gate")!.steps;
+    const show = gateSteps[0] as ActivityStep;
+    expect(show.fn).toBe("terraformShow");
+    expect(show.outcomeAttribute).toEqual({ name: "Destroys", from: "destroys" });
+    expect(gateSteps[1].kind).toBe("gate");
   });
 
-  test("an explicit taskQueue wins", () => {
-    expect(props({ name: "app-apply", root: "app", taskQueue: "infra" }).taskQueue).toBe("infra");
+  test("the gate description tells the approver what the exit-3 refusal does", () => {
+    const dir = project();
+    const op = props({ name: "estate-apply", root: "estate", cwd: dir });
+    const gateStep = op.phases.find((p) => p.name === "Gate")!.steps.find(isGate)!;
+    expect(gateStep.description).toContain("live root");
+    expect(gateStep.description).toContain("exit status 3");
+    expect(gateStep.description).toContain("choudoufu #878");
+  });
+
+  test("a stock root's gate description says nothing about a live re-plan", () => {
+    const dir = mkdtempSync(join(tmpdir(), "chant-tf-apply-op-live-"));
+    dirs.push(dir);
+    mkdirSync(join(dir, "root"), { recursive: true });
+    writeFileSync(join(dir, "root", "main.tf"), 'resource "null_resource" "x" {}\n');
+    writeFileSync(
+      join(dir, "chant.config.json"),
+      JSON.stringify({ terraform: { binary: "terraform", roots: { estate: { dir: "./root" } } } }),
+    );
+    const op = props({ name: "estate-apply", root: "estate", cwd: dir });
+    const gateStep = op.phases.find((p) => p.name === "Gate")!.steps.find(isGate)!;
+    expect(gateStep.description).not.toContain("exit status 3");
+    expect(gateStep.description).not.toContain("live root");
+  });
+
+  test("refuses to build when the root's policy sets undeclared_untagged = \"delete\"", () => {
+    const dir = project('undeclared_untagged = "delete"');
+    expect(() => TerraformApplyOp({ name: "estate-apply", root: "estate", cwd: dir })).toThrow(
+      /TerraformApplyOp "estate-apply".*undeclared_untagged = "delete"/s,
+    );
+  });
+
+  test("builds fine when the root's policy sets undeclared_untagged to something else", () => {
+    const dir = project('undeclared_untagged = "report"');
+    expect(() => TerraformApplyOp({ name: "estate-apply", root: "estate", cwd: dir })).not.toThrow();
+  });
+
+  test("a choudoufu root with no declared estate builds the same phases and skips the policy read", () => {
+    const dir = mkdtempSync(join(tmpdir(), "chant-tf-apply-op-live-"));
+    dirs.push(dir);
+    mkdirSync(join(dir, "root"), { recursive: true });
+    writeFileSync(join(dir, "root", "main.tf"), 'resource "null_resource" "x" {}\n');
+    writeFileSync(
+      join(dir, "chant.config.json"),
+      JSON.stringify({ terraform: { binary: "choudoufu", roots: { estate: { dir: "./root" } } } }),
+    );
+
+    const op = props({ name: "estate-apply", root: "estate", cwd: dir, gate: "never" });
+    const fns = op.phases.flatMap((p) => p.steps.filter(isActivity)).map((s) => s.fn);
+    expect(fns).toEqual(["terraformInit", "terraformPlan", "terraformApply"]);
   });
 });

package/src/composites/terraform-apply-op.ts

@@ -1,17 +1,66 @@
 /**
- * TerraformApplyOp composite (#2086) — init, plan, approve, apply for one root
+ * TerraformApplyOp composite (#2086), init, plan, approve, apply for one root
  * module named in `terraform.roots`.
  *
  * Authority stays with terraform: chant runs the binary, reads its plan, and
- * hands the same saved plan to apply. The Apply step never re-plans, because
- * it takes the Plan step's own `planFile` as a `StepOutputRef` — whatever was
- * approved is what runs.
+ * hands the same saved plan to apply. The Apply step never applies something
+ * no gate saw, because it takes the Plan step's own `planFile` as a
+ * `StepOutputRef`.
  *
- * Phases: Init, Plan, Gate, Apply.
+ * Phases: Init, Plan, Gate, Apply. One shape, both kinds of root. A live root
+ * (#2103, `terraform.binary: "choudoufu"` plus a declared estate) ran a
+ * different shape for one release, because choudoufu refused `-out` and
+ * `apply <planfile>`; choudoufu v0.13.0 admits both under a `live` block
+ * ([choudoufu #878](https://github.com/INTENTIUS/choudoufu/issues/878),
+ * PR 889), so the plan-file discipline is back and the two shapes are one
+ * again.
  *
- * The gate is durable-runtime work, so an Op that emits one needs Temporal;
- * `packages/core/src/op/local-executor.ts` refuses any Op containing a gate.
- * `gate: "never"` is what makes the Op runnable with `chant run` locally.
+ * **What the approval covers on a live root.** `plan -out=<planFile>` writes
+ * stock's own plan file, and that file is what the approver reads and what
+ * the Apply step names. `apply <planFile>` does not replay it: prior state on
+ * a live root is a projection rebuilt from the live system every run, so the
+ * apply re-plans against the live system the way every live-markers run does,
+ * then compares its fresh plan with the file's. Same addresses, same actions,
+ * same live objects, and the same planned values, or it refuses before
+ * anything changes:
+ *
+ *   - `The approved plan no longer matches the live system`, and
+ *   - `The approved plan belongs to a different estate`,
+ *
+ * both with exit status **3**, which is neither 1 (any ordinary failure) nor
+ * `-detailed-exitcode`'s 2. `terraformApply` maps that status to a named
+ * result rather than a thrown error (`refused: "approval-mismatch" |
+ * "wrong-estate"`, with choudoufu's message in `refusal`), so a workflow
+ * reading the Apply step's output can route the run back to review instead of
+ * treating it as a broken step. The seam #2106 left named and unused on the
+ * apply args is now the plan file itself.
+ *
+ * TF101 therefore fires on a live root's `terraformApply` call again: there
+ * is a plan file to pair once more, and pairing it is what the refusal above
+ * has to compare against.
+ *
+ * **Delete modes.** chant's `delete: "never" | "owned-only" | "gated"`
+ * (`terraform.roots.<name>.delete`, `../config.ts`) maps onto choudoufu's
+ * `policy` block. `"owned-only"` is choudoufu's own default verb for the
+ * `undeclared_tagged` quadrant (an orphaned marked resource) and needs
+ * nothing; `"gated"` needs nothing beyond this composite's own approval gate;
+ * `"never"` requires the root's `policy` block to set `undeclared_tagged` to
+ * `"keep"`, `"untag"` or `"report"`, and TF026 (`../lint/post-synth/tf026.ts`)
+ * enforces that at build time, naming the setting to add. Separately, and
+ * regardless of `delete`, this composite refuses outright to build against a
+ * root whose `policy` sets `undeclared_untagged = "delete"` (account-scoped
+ * reconciliation, which needs a `scope` block): that quadrant deletes
+ * resources the estate never claimed, anywhere the scope reaches, and chant
+ * never proposes deleting a resource it does not own, not for a root, and not
+ * for an Op it generated.
+ *
+ * A gate is a fact on the gate ledger, not a wait (#2119). Reaching one,
+ * `chant run` consults the ledger (`packages/core/src/op/gate.ts`): a
+ * resolution newer than the gate's newest pending fact lets the run walk
+ * through, and anything else records the pending fact and ends the run with
+ * status `gated` and exit 3. `chant approve <op> <gate>` writes the
+ * resolution, and the next run reads it. `gate: "never"` drops the Gate phase
+ * entirely, so a run never stops.
  *
  * @example
  * ```typescript
@@ -23,6 +72,8 @@
 
 import { Op, phase, gate, activity, OpResource } from "@intentius/chant/op";
 import { DEFAULT_PLAN_FILE } from "../op/activities/terraform";
+import { detectLivePolicyVerbs } from "../op/activities/live-detect";
+import { resolveRootModeSync } from "../op/resolve-root-mode";
 import {
   terraformInit as initStep,
   terraformPlan as planStep,
@@ -38,14 +89,14 @@ import {
  * cannot branch at build time on a count the plan only produces at run time.
  * The workable v1 is that `"on-destroy"` and `"always"` emit the same Gate
  * phase, and the approver is told what is at stake instead: the phase reports
- * the plan's `destroys` count as the `Destroys` search attribute before it
- * waits, and the gate description says so. A gate that skips itself when the
- * plan turns out additive is a new step kind, out of scope here.
+ * the plan's `destroys` count as the `Destroys` run outcome before the
+ * gate is reached, and the gate description says so. A gate that skips itself
+ * when the plan turns out additive is a new step kind, out of scope here.
  */
 export type TerraformGateMode = "on-destroy" | "always" | "never";
 
 export interface TerraformApplyOpConfig {
-  /** Op name (kebab-case). Also the default task queue and gate signal suffix. */
+  /** Op name (kebab-case). `signalName` defaults to `approve-<name>`. */
   name: string;
   /** Key into the project's `terraform.roots`. The root carries dir, workspace, var files and backend config. */
   root: string;
@@ -59,7 +110,7 @@ export interface TerraformApplyOpConfig {
   gate?: TerraformGateMode;
   /** Gate signal name. Default: `approve-<name>`, as `ApplyOp` does. */
   signalName?: string;
-  /** Temporal duration the gate waits before timing out. Default: core's own (48h). */
+  /** How long a recorded pending gate stays valid, as a duration string. Default: core's own (48h). */
   gateTimeout?: string;
   /** Override the gate description shown to the approver. */
   gateDescription?: string;
@@ -78,15 +129,13 @@ export interface TerraformApplyOpConfig {
    * Terraform has no automatic rollback: a half-applied plan is undone by
    * planning and applying the inverse, which is a decision about the estate
    * rather than something chant can synthesize. So compensation here is
-   * total or refused, the same stance `ApplyOp` takes (`lexicons/temporal/src/
+   * total or refused, the same stance `ApplyOp` takes (`packages/core/src/op/
    * composites/apply-op.ts`) — `true`, or an object with no `command`, throws
    * when the Op is built, naming the Op, rather than warning at the moment a
    * rollback is already needed. Supply `compensate: { command: "..." }` with a
    * rollback of your own, or leave it unset.
    */
   compensate?: boolean | { command?: string };
-  /** Override the task queue. Defaults to `name`. */
-  taskQueue?: string;
 }
 
 export interface TerraformApplyOpResources {
@@ -95,7 +144,6 @@ export interface TerraformApplyOpResources {
 }
 
 export function TerraformApplyOp(config: TerraformApplyOpConfig): TerraformApplyOpResources {
-  const taskQueue = config.taskQueue ?? config.name;
   const planFile = config.planFile ?? DEFAULT_PLAN_FILE;
   const gateMode: TerraformGateMode = config.gate ?? "on-destroy";
 
@@ -116,20 +164,45 @@ export function TerraformApplyOp(config: TerraformApplyOpConfig): TerraformApply
   // travels with each of them rather than being read off the process once.
   const where = config.cwd ? { cwd: config.cwd } : {};
 
-  // `id` is what makes `plan.out` legal, and `plan.out.planFile` is how the
-  // Apply step below names this step's saved plan.
-  const plan = planStep(config.root, { planFile, ...where, id: "plan" });
-  plan.outcomeAttribute = { name: "Changed", from: "changed" };
+  // Best-effort, synchronous (chant.config.json only — see
+  // resolveRootModeSync's own doc comment): "unknown" reads as stock, the
+  // conservative direction. The mode no longer changes which steps are
+  // emitted; it decides the policy refusal below and the wording of the gate.
+  const resolved = resolveRootModeSync(config.root, config.cwd);
+  const live = resolved?.mode === "live";
+
+  if (live) {
+    // Regardless of `delete`: an account-scoped purge is never something
+    // chant proposes on an Op's own initiative. TF026 handles the narrower,
+    // config-driven `delete: "never"` requirement; this is unconditional.
+    const verbs = detectLivePolicyVerbs(resolved!.dir);
+    if (verbs?.undeclaredUntagged === "delete") {
+      throw new Error(
+        `TerraformApplyOp "${config.name}": root "${config.root}"'s policy block sets ` +
+          `undeclared_untagged = "delete" (account-scoped reconciliation, scoped by a \`scope\` block). ` +
+          "chant never proposes deleting a resource it does not own, and neither does an Op it " +
+          "generates. Remove that setting from the policy block, or narrow the estate's ownership " +
+          "answer instead of the account's.",
+      );
+    }
+  }
 
   const phases = [
     phase("Init", [initStep(config.root, { ...where, ...(config.upgrade ? { upgrade: true } : {}) })]),
-    phase("Plan", [plan]),
   ];
 
+  // `id` is what makes `plan.out` legal, and `plan.out.planFile` is how the
+  // Apply step below names this step's saved plan. On a live root that file
+  // is also the approval artifact the apply re-plans against, so the same
+  // reference carries the approval as well as the path.
+  const plan = planStep(config.root, { planFile, ...where, id: "plan" });
+  plan.outcomeAttribute = { name: "Changed", from: "changed" };
+  phases.push(phase("Plan", [plan]));
+
   if (gateMode !== "never") {
-    // Re-render the saved plan just before the wait, so the approver's
+    // Re-render the saved plan just before the gate, so the approver's
     // `Destroys` attribute comes off the plan that will actually apply.
-    // `show` against a plan file calls no provider.
+    // `show` against a plan file calls no provider, on either kind of root.
     const show = showStep(config.root, { ...where, planFile: plan.out.planFile });
     show.outcomeAttribute = { name: "Destroys", from: "destroys" };
     phases.push(
@@ -139,8 +212,13 @@ export function TerraformApplyOp(config: TerraformApplyOpConfig): TerraformApply
           ...(config.gateTimeout ? { timeout: config.gateTimeout } : {}),
           description:
             config.gateDescription ??
-            `Approve terraform apply of root "${config.root}" (gate: ${gateMode}). ` +
-              `The Destroys search attribute on this phase is the plan's destroy count.`,
+            `Approve terraform apply of ${live ? "live " : ""}root "${config.root}" (gate: ${gateMode}). ` +
+              `The Destroys run outcome from this phase is the plan's destroy count.` +
+              (live
+                ? " The apply that follows re-plans against the live system and applies this plan file only" +
+                  " if its own fresh plan agrees; otherwise it refuses with exit status 3 and the Apply" +
+                  " step reports a named refusal for review (choudoufu #878)."
+                : ""),
         }),
       ]),
     );
@@ -151,8 +229,7 @@ export function TerraformApplyOp(config: TerraformApplyOpConfig): TerraformApply
   const op = Op({
     name: config.name,
     overview: `Init, plan and apply the "${config.root}" terraform root`,
-    taskQueue,
-    searchAttributes: {
+    labels: {
       Apply: "true",
       TerraformRoot: config.root,
     },